{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Extracting data from MISP using PyMISP"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Recovering the API KEY"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- Go to `Global Actions` then `My Profile`\n",
    "- Access the `/users/view/me` URL"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 491,
   "metadata": {},
   "outputs": [],
   "source": [
    "from pymisp import PyMISP\n",
    "import urllib3\n",
    "urllib3.disable_warnings()\n",
    "\n",
    "misp_url = 'https://localhost:8443/'\n",
    "misp_key = 'GqfuZo444EFlylND0XaKZsEXgWgkPgguUZ6KVRuq'\n",
    "# Should PyMISP verify the MISP certificate\n",
    "misp_verifycert = False\n",
    "\n",
    "misp = PyMISP(misp_url, misp_key, misp_verifycert)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 492,
   "metadata": {},
   "outputs": [],
   "source": [
    "import datetime\n",
    "from pprint import pprint\n",
    "import base64\n",
    "import subprocess"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Retreiving an Event"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 493,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<MISPEvent(info=Test PUSH filtering type)\n",
      "<class 'dict'>\n"
     ]
    }
   ],
   "source": [
    "r1 = misp.get_event('7907c4a9-a15c-4c60-a1b4-1d214cf8cf41', pythonify=True)\n",
    "print(r1)\n",
    "r2 = misp.get_event(2, pythonify=False)\n",
    "print(type(r2))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Searching the Event index"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 494,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "7907c4a9-a15c-4c60-a1b4-1d214cf8cf41\n"
     ]
    }
   ],
   "source": [
    "r = misp.search_index(pythonify=True)\n",
    "print(r[1].uuid)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Only published Events"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 495,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[<MISPEvent(info=Test 43214324), <MISPEvent(info=Test enrichment via WF), <MISPEvent(info=Big event), <MISPEvent(info=Small event)]\n"
     ]
    }
   ],
   "source": [
    "r = misp.search_index(published=True, pythonify=True)\n",
    "print(r)\n",
    "# print(r[0].to_dict())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Playing with time"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Multiple type of timestamps for Events**\n",
    "- `timestamp`: Timestamp of the **last modification** of the Event or its content (include Attributes, Objects, Tags, ...)\n",
    "- `published_timestamp`: Timestamp of the **last publication** of the Event\n",
    "- To generate report, you usually want to use `publish_timestamp`\n",
    "\n",
    "**Multiple type of dates for Events**\n",
    "- `date_from`: Only events having a more recent date will be returned\n",
    "- `date_to`: Only events having an older date will be returned\n",
    "- Both can be used at once to specify a time window\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 496,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[<MISPEvent(info=Test 43214324), <MISPEvent(info=Test enrichment via WF)]\n"
     ]
    }
   ],
   "source": [
    "# Using string literal\n",
    "sinceLastMonth = '30d'\n",
    "# Using Python's datetime\n",
    "sinceLastMonth = datetime.date.today() - datetime.timedelta(days=30)\n",
    "\n",
    "r = misp.search_index(published=True, publish_timestamp=sinceLastMonth, pythonify=True)\n",
    "print(r)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Data returned\n",
    "- Searching the index will only returns high-level information about the Event and its attached context\n",
    "\n",
    "- Can be useful for:\n",
    "    - Statistics about number of created Event\n",
    "    - Statistics about Organisation creating Event over time\n",
    "    - Statistics about distribution level usage\n",
    "- And, **If Event correctly contextualized**\n",
    "    - Statistics about **type of incident**\n",
    "    - Adversary tactics and techniques with **MITRE ATT&CK** usage\n",
    "    - Malware familly"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 497,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# Event properties\n",
      "['uuid', 'info', 'distribution', 'threat_level_id', 'analysis', 'published', 'date', 'id', 'orgc_id', 'org_id', 'timestamp', 'publish_timestamp', 'sighting_timestamp', 'sharing_group_id', 'Org', 'Orgc', 'attribute_count', 'proposal_email_lock', 'locked', 'disable_correlation', 'extends_uuid', 'GalaxyCluster', 'EventTag']\n",
      "\n",
      " # Event Tags (12)\n",
      "{'Tag': {'colour': '#326300',\n",
      "         'id': '29',\n",
      "         'is_galaxy': False,\n",
      "         'name': 'circl:incident-classification=\"phishing\"'},\n",
      " 'event_id': '18',\n",
      " 'id': '69',\n",
      " 'local': False,\n",
      " 'relationship_type': '',\n",
      " 'tag_id': '29'}\n",
      "\n",
      " # Event Clusters (11)\n"
     ]
    }
   ],
   "source": [
    "event = r[0].to_dict()\n",
    "event_properties = event.keys()\n",
    "print('# Event properties')\n",
    "print(list(event_properties))\n",
    "\n",
    "print('\\n # Event Tags ({0})'.format(len(event['EventTag'])))\n",
    "pprint(event['EventTag'][0])\n",
    "\n",
    "print('\\n # Event Clusters ({0})'.format(len(event['GalaxyCluster'])))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Useful parameters\n",
    "\n",
    "- `attribute` (Optional[str]) *Filter events on attribute's value*\n",
    "- `published` (Optional[bool])\n",
    "- `hasproposal` (Optional[bool])\n",
    "- `eventid` (Optional[str, int])\n",
    "- `tags` (Optional[str, List[str]])\n",
    "- `date_from` (Optional[datetime, date, int, str, float, None])\n",
    "- `date_to` (Optional[datetime, date, int, str, float, None])\n",
    "- `eventinfo` (Optional[str])\n",
    "- `threatlevel` (Optional[str, int])\n",
    "- `analysis` (Optional[str, int])\n",
    "- `distribution` (Optional[str, int])\n",
    "- `sharinggroup` (Optional[str, int])\n",
    "- `org` (Optional[str, List[[str, int]])\n",
    "- `timestamp` (Optional[datetime, date, int, str, float, None, List[[datetime, date, int, str, float, None], [datetime, date, int, str, float, None]]])\n",
    "    - timestamp=(datetime.today() - timedelta(days=1))\n",
    "    - timestamp=['14d', '7d']\n",
    "    - timestamp=int(datetime.today().timestamp())\n",
    "- `publish_timestamp` (Optional[datetime, date, int, str, float, None, List[[datetime, date, int, str, float, None], [datetime, date, int, str, float, None]]])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Retreiving data with RestSearch\n",
    "\n",
    "The `RestSearch` endpoint can be used on multiple scopes. It has more filtering parameters and is generally flexible.\n",
    "\n",
    "Supported scopes (also called Controllers): `events`, `attributes`, `objects`\n",
    "\n",
    "### `/events/restSearch` VS `/attributes/restSearch`\n",
    "\n",
    "- Both endpoints support most of the parameter\n",
    "- They differs in the data returned\n",
    "    - `/events/restSearch` returns the whole Event with its child elements (Attributes, Objects, Proposals, ..)\n",
    "    - `/attributes/restSearch` returns all attributes"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Getting only metadata: Do not include child elements (such as Attributes, ...)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 498,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[<MISPEvent(info=Test), <MISPEvent(info=Test PUSH filtering type), <MISPEvent(info=Decaying example), <MISPEvent(info=Test tag filtering), <MISPEvent(info=Should not be pulled), <MISPEvent(info=Event report example), <MISPEvent(info=Wireshark test event), <MISPEvent(info=Test 4), <MISPEvent(info=Test 43214324), <MISPEvent(info=Test btc), <MISPEvent(info=Analysis of a Flubot malware captured by a honeypot), <MISPEvent(info=Test enrichment via WF), <MISPEvent(info=Test TLP replace), <MISPEvent(info=Test event for MM), <MISPEvent(info=Big event), <MISPEvent(info=test 77), <MISPEvent(info=Small event), <MISPEvent(info=Small event), <MISPEvent(info=Infection via spear-phishing email), <MISPEvent(info=test event TLPs), <MISPEvent(info=test), <MISPEvent(info=Test event ip|port -> ip-port), <MISPEvent(info=test bgp), <MISPEvent(info=test tlp:white and clear), <MISPEvent(info=Test)]\n"
     ]
    }
   ],
   "source": [
    "r = misp.search(controller='events', metadata=True, pythonify=True)\n",
    "print(r)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Searching Attributes with RestSearch"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Searching for values"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 499,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Simple value: [<MISPAttribute(type=ip-src, value=8.8.8.8), <MISPAttribute(type=ip-dst, value=8.8.8.8), <MISPAttribute(type=ip-dst|port, value=8.8.8.8|443)]\n",
      "List of values: [<MISPAttribute(type=ip-src, value=5.4.2.1), <MISPAttribute(type=ip-src, value=8.8.8.8), <MISPAttribute(type=ip-dst, value=8.8.8.8), <MISPAttribute(type=ip-dst|port, value=8.8.8.8|443)]\n",
      "Wildcard: [<MISPAttribute(type=url, value=https://www.github.com/stricaud)]\n"
     ]
    }
   ],
   "source": [
    "r1 = misp.search(controller='attributes', value='8.8.8.8', pythonify=True)\n",
    "print('Simple value:', r1)\n",
    "\n",
    "r2 = misp.search(controller='attributes', value=['8.8.8.8', '5.4.2.1'], pythonify=True)\n",
    "print('List of values:', r2)\n",
    "\n",
    "r3 = misp.search(controller='attributes', value=['https://www.github.com/%'], pythonify=True)\n",
    "print('Wildcard:', r3)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Searching for types"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 500,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[<MISPAttribute(type=first-name, value=Sam), <MISPAttribute(type=first-name, value=NETRICSA), <MISPAttribute(type=first-name, value=Mental), <MISPAttribute(type=first-name, value=Andrew)]\n",
      "[<MISPAttribute(type=attachment, value=SeriousSam.png), <MISPAttribute(type=attachment, value=mental.png), <MISPAttribute(type=attachment, value=EDF.png), <MISPAttribute(type=attachment, value=malicious.exe), <MISPAttribute(type=attachment, value=malicious.exe), <MISPAttribute(type=attachment, value=original.jpeg), <MISPAttribute(type=attachment, value=payload-1-8), <MISPAttribute(type=attachment, value=drawing.svg), <MISPAttribute(type=attachment, value=drawing.png), <MISPAttribute(type=attachment, value=Screenshot from 2021-10-19 16-31-56.png), <MISPAttribute(type=malware-sample, value=sample.apk|eff61f1bf7b14d261d5b421208d1bf68), <MISPAttribute(type=malware-sample, value=malware.exe|70f3bc193dfa56b78f3e6e4f800f701f)]\n"
     ]
    }
   ],
   "source": [
    "r1 = misp.search(controller='attributes', type_attribute='first-name', pythonify=True)\n",
    "print(r1)\n",
    "\n",
    "r2 = misp.search(controller='attributes', type_attribute=['malware-sample', 'attachment'], pythonify=True)\n",
    "print(r2)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Searching for tags"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 501,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Simple tag: 9\n",
      "\tFirst Attribute [<MISPTag(name=tlp:red)>]\n",
      "List of tags: 18\n",
      "\tThird Attribute [<MISPTag(name=PAP:RED)>, <MISPTag(name=adversary:infrastructure-type=\"exploit-distribution-point\")>]\n"
     ]
    }
   ],
   "source": [
    "r1 = misp.search(controller='attributes', tags='tlp:red', pythonify=True)\n",
    "print('Simple tag:', len(r1))\n",
    "print('\\tFirst Attribute', r1[0].Tag)\n",
    "\n",
    "r2 = misp.search(controller='attributes', tags=['PAP:RED', 'tlp:red'], pythonify=True)\n",
    "print('List of tags:', len(r2))\n",
    "print('\\tThird Attribute', r2[2].Tag)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 502,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Wildcard: 22\n",
      "\tTags of all Attributes: [[], [], [], [], [], [], [], [], [], [], [], [], [<MISPTag(name=tlp:red)>], [], [], [], [], [], [], [], [], [<MISPTag(name=test_foo)>]]\n",
      "\n",
      "Open question: Why do we have Attributes despite them not having the correct tag attached?\n",
      "\n"
     ]
    }
   ],
   "source": [
    "r3 = misp.search(controller='attributes', tags=['misp-galaxy:target-information=%'], pythonify=True)\n",
    "print('Wildcard:', len(r3))\n",
    "print('\\tTags of all Attributes:', [attr.Tag for attr in r3])\n",
    "print()\n",
    "print(base64.b64decode('T3BlbiBxdWVzdGlvbjogV2h5IGRvIHdlIGhhdmUgQXR0cmlidXRlcyBkZXNwaXRlIHRoZW0gbm90IGhhdmluZyB0aGUgY29ycmVjdCB0YWcgYXR0YWNoZWQ/Cg==').decode())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 503,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "All unique Event tags: {'misp-galaxy:target-information=\"Canada\"', 'misp-galaxy:target-information=\"China\"', 'misp-galaxy:target-information=\"Germany\"', 'misp-galaxy:target-information=\"Luxembourg\"'}\n"
     ]
    }
   ],
   "source": [
    "allEventTags = [\n",
    "    [tag.name for tag in misp.get_event(attr.event_id, pythonify=True).Tag if tag.name.startswith('misp-galaxy:target-information=')]\n",
    "    for attr in r3\n",
    "]\n",
    "allUniqueEventTag = set()\n",
    "for tags in allEventTags:\n",
    "    for tag in tags:\n",
    "        allUniqueEventTag.add(tag)\n",
    "print('All unique Event tags:', allUniqueEventTag)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 504,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Negation: 17\n",
      "All unique Event tags: {'misp-galaxy:target-information=\"Canada\"', 'misp-galaxy:target-information=\"China\"', 'misp-galaxy:target-information=\"Germany\"'}\n"
     ]
    }
   ],
   "source": [
    "r4 = misp.search(\n",
    "    controller='attributes',\n",
    "    tags=['misp-galaxy:target-information=%', '!misp-galaxy:target-information=\"Luxembourg\"'],\n",
    "    pythonify=True)\n",
    "print('Negation:', len(r4))\n",
    "\n",
    "\n",
    "# Showing unique Event tags\n",
    "allEventTags = [\n",
    "    [tag.name for tag in misp.get_event(attr.event_id, pythonify=True).Tag if tag.name.startswith('misp-galaxy:target-information=')]\n",
    "    for attr in r4\n",
    "]\n",
    "allUniqueEventTag = set()\n",
    "for tags in allEventTags:\n",
    "    for tag in tags:\n",
    "        allUniqueEventTag.add(tag)\n",
    "print('All unique Event tags:', allUniqueEventTag)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Want to also have the Event tags included**?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 505,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Tags of first attibute: []\n",
      "Tags of first attibute: ['tlp:white', 'osint:lifetime=\"perpetual\"', 'osint:certainty=\"50\"', 'workflow:state=\"draft\"', 'misp-galaxy:threat-actor=\"APT 29\"', 'smo:sync', 'misp-galaxy:target-information=\"Canada\"', 'misp-galaxy:target-information=\"China\"', 'misp-galaxy:sector=\"Defense\"', 'misp-galaxy:sector=\"Infrastructure\"', 'misp-galaxy:malpedia=\"Kobalos\"', 'misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"', 'misp-galaxy:mitre-attack-pattern=\"Software - T1592.002\"']\n"
     ]
    }
   ],
   "source": [
    "r5 = misp.search(\n",
    "    controller='attributes',\n",
    "    tags='misp-galaxy:target-information=%',\n",
    "    pythonify=True)\n",
    "print('Tags of first attibute:', [tag.name for tag in r5[0].Tag])\n",
    "\n",
    "r6 = misp.search(\n",
    "    controller='attributes',\n",
    "    tags='misp-galaxy:target-information=%',\n",
    "    includeEventTags=True,\n",
    "    pythonify=True)\n",
    "print('Tags of first attibute:', [tag.name for tag in r6[0].Tag])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Complex query**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 506,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Or: 1056\n",
      "[['tlp:amber'], ['tlp:amber'], ['tlp:amber'], ['tlp:amber'], ['tlp:amber']]\n",
      "\n",
      "And: 5\n",
      "[['adversary:infrastructure-type=\"c2\"', 'tlp:amber'],\n",
      " ['adversary:infrastructure-type=\"c2\"', 'tlp:amber'],\n",
      " ['adversary:infrastructure-type=\"c2\"', 'tlp:amber'],\n",
      " ['adversary:infrastructure-type=\"c2\"', 'tlp:amber'],\n",
      " ['adversary:infrastructure-type=\"c2\"', 'tlp:amber']]\n"
     ]
    }
   ],
   "source": [
    "complex_query = misp.build_complex_query(or_parameters=['tlp:amber', 'adversary:infrastructure-type=\"c2\"'])\n",
    "r7 = misp.search(\n",
    "    controller='attributes',\n",
    "    tags=complex_query,\n",
    "    includeEventTags=True,\n",
    "    pythonify=True)\n",
    "print('Or:', len(r7))\n",
    "pprint([\n",
    "    [tag.name for tag in attr.Tag if (tag.name == 'tlp:amber' or tag.name == 'adversary:infrastructure-type=\"c2\"')] for attr in r7[:5]\n",
    "])\n",
    "print()\n",
    "\n",
    "complex_query = misp.build_complex_query(and_parameters=['tlp:amber', 'adversary:infrastructure-type=\"c2\"'])\n",
    "r8 = misp.search(\n",
    "    controller='attributes',\n",
    "    tags=complex_query,\n",
    "    includeEventTags=True,\n",
    "    pythonify=True)\n",
    "print('And:', len(r8))\n",
    "pprint([\n",
    "    [tag.name for tag in attr.Tag if (tag.name == 'tlp:amber' or tag.name == 'adversary:infrastructure-type=\"c2\"')] for attr in r8\n",
    "])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Searching on GalaxyCluster metadata"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 507,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Events:  2\n",
      "[['misp-galaxy:target-information=\"Canada\"',\n",
      "  'misp-galaxy:target-information=\"China\"'],\n",
      " ['misp-galaxy:target-information=\"Luxembourg\"']]\n"
     ]
    }
   ],
   "source": [
    "body = {\n",
    "    'galaxy.member-of': 'NATO',\n",
    "    'galaxy.official-languages': 'French',\n",
    "}\n",
    "\n",
    "events = misp.direct_call('/events/restSearch', body)\n",
    "print('Events: ', len(events))\n",
    "pprint([\n",
    "    [tag['name'] for tag in event['Event']['Tag'] if tag['name'].startswith('misp-galaxy:target-information')] for event in events\n",
    "])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- **Note 1**: The `galaxy.*` instructions are not supported by PyMISP\n",
    "- **Note 2**: Each `galaxy.*` instructions are **AND**ed and are applied for the same cluster\n",
    "    - Cannot combine from different clusters\n",
    "    - Combining `Galaxy.official-languages` and `Galaxy.synonyms` would likely gives no result"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Searching on creator Organisation metadata"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 508,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Organisation nationality: {'admin_org': '', 'CIRCL': '', 'ORGNAME': '', 'Training': 'Luxembourg'}\n",
      "Events:  4\n",
      "Org for each Event: ['Training', 'Training', 'Training', 'Training']\n"
     ]
    }
   ],
   "source": [
    "all_orgs = misp.organisations()\n",
    "print('Organisation nationality:', {org['Organisation']['name']: org['Organisation']['nationality'] for org in all_orgs})\n",
    "\n",
    "body = {\n",
    "    'org.nationality': ['Luxembourg'],\n",
    "    'org.sector': ['financial'],\n",
    "}\n",
    "\n",
    "events = misp.direct_call('/events/restSearch', body)\n",
    "print('Events: ', len(events))\n",
    "print('Org for each Event:', [event['Event']['Orgc']['name'] for event in events])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- **Note 1**: The `org.*` instructions are not supported by PyMISP"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### ReturnFormat"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**CSV**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 509,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "uuid,event_id,category,type,value,comment,to_ids,date,object_relation,attribute_tag,object_uuid,object_name,object_meta_category\n",
      "\"724d5417-41e6-40a5-b368-bdfbe652302a\",2,\"Network activity\",\"ip-dst\",\"4.3.2.1\",\"Hello all!\",0,1639127173,\"\",\"\",\"\",\"\",\"\"\n",
      "\"ba8e1a5a-6bb6-4ae5-9872-0a01b6b05cad\",2,\"Network activity\",\"ip-dst\",\"5.3.1.2\",\"\",1,1639060465,\"ip\",\"\",\"\",\"\",\"\"\n",
      "\"8c16cf20-d5bd-4ed3-b243-98c00c16e591\",2,\"Network activity\",\"ip-dst\",\"23.1.4.2\",\"\",1,1639126626,\"ip\",\"\",\"\",\"\",\"\"\n",
      "\"25a7bbb0-31f6-4525-94c0-89af86030201\",16,\"Network activity\",\"ip-dst\",\"127.0.0.1\",\"\",1,1645191487,\"ip-dst\",\"\",\"\",\"\",\"\"\n",
      "\"f3eb2f37-d08d-4dbb-be0c-346ac508693f\",16,\"Network activity\",\"ip-dst\",\"127.0.0.1\",\"\",1,1645191487,\"ip-dst\",\"\",\"\",\"\",\"\"\n",
      "\"f0a002d8-38a5-40f9-9a62-7e975cc8f987\",16,\"Network activity\",\"ip-dst\",\"127.0.0.1\",\"\",1,1645191487,\"ip-dst\",\"\",\"\",\"\",\"\"\n",
      "\"61bfb8e3-20e3-4f37-905d-9d4e14f2564a\",20,\"Network activity\",\"ip-dst\",\"8.231.77.176\",\"\",1,1665471239,\"ip\",\"PAP:RED,adversary:infrastructure-type=\"\"exploit-distribution-point\"\"\",\"\",\"\",\"\"\n",
      "\"1ac08260-a5d6-4bee-bdcd-1525685ea07d\",20,\"Network activity\",\"ip-dst\",\"226.140.183.77\",\"\",1,1665471204,\"ip\",\"PAP:RED,adversary:infrastructure-type=\"\"c2\"\"\",\"\",\"\",\"\"\n",
      "\"78ce291d-241b-4162-8d6b-6a85964a31b8\",20,\"Network activity\",\"ip-dst\",\"2efe:65b4:7533:4f5f:1081:995:ff87:348f\",\"\",1,1665471204,\"ip\",\"PAP:RED,adversary:infrastructure-type=\"\"c2\"\"\",\"\",\"\",\"\"\n",
      "\"b760f7a7-0d96-4b47-86b2-d5524cd2eff0\",26,\"Network activity\",\"ip-dst\",\"8.8.8.8\",\"\",1,1663321650,\"ip\",\"\",\"\",\"\",\"\"\n",
      "\"9023deba-1ba0-4ab3-a0bf-64a2d5c90520\",29,\"Network activity\",\"ip-dst\",\"81.177.170.166\",\"\",1,1665472920,\"ip\",\"adversary:infrastructure-type=\"\"c2\"\",misp-galaxy:mitre-attack-pattern=\"\"Botnet - T1583.005\"\"\",\"\",\"\",\"\"\n",
      "\"c9d681ad-4087-4847-8f93-aef2e54452f2\",42,\"Network activity\",\"ip-dst\",\"2.2.2.2\",\"\",0,1671095982,\"ip\",\"\",\"\",\"\",\"\"\n",
      "\"60950f6a-b3bf-4a0a-b901-43308e2f761a\",2,\"Network activity\",\"ip-src\",\"1.2.3.4\",\"\",0,1639060409,\"\",\"\",\"\",\"\",\"\"\n",
      "\"f2a6eb8c-7a3e-4524-8036-1b90cb18fe75\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.0\",\"today\",1,1622184577,\"\",\"\",\"\",\"\",\"\"\n",
      "\"93bc9e55-20e9-4be1-b3e5-057e56a3b82e\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.1\",\"today - 1 days\",1,1622184577,\"\",\"\",\"\",\"\",\"\"\n",
      "\"f7771a53-fbdf-4980-822d-9a2339ce9076\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.2\",\"today - 2 days\",1,1622184577,\"\",\"\",\"\",\"\",\"\"\n",
      "\"4972022a-26fd-4270-b614-506a9c951be6\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.3\",\"today - 3 days\",1,1622184578,\"\",\"admiralty-scale:information-credibility=\"\"1\"\",admiralty-scale:source-reliability=\"\"a\"\"\",\"\",\"\",\"\"\n",
      "\"c661cd4b-0474-48eb-b4ed-eb02f6b569ea\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.4\",\"today - 4 days\",1,1622184578,\"\",\"\",\"\",\"\",\"\"\n",
      "\"42f68239-a794-492c-8fed-7520677824b0\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.5\",\"today - 5 days\",1,1622184578,\"\",\"\",\"\",\"\",\"\"\n",
      "\"d6404ba7-c847-49b8-8748-3029ce62e2b0\",7,\"Payload delivery\",\"ip-src\",\"149.23.54.6\",\"today - 6 days\",1,1622184578,\"\",\"\",\"\",\"\",\"\"\n",
      "\"f04de340-ec63-471e-b5a2-66c3fe0676b6\",9,\"Network activity\",\"ip-src\",\"5.4.2.1\",\"\",0,1650956697,\"\",\"misp-galaxy:mitre-course-of-action=\"\"Access Token Manipulation Mitigation - T1134\"\"\",\"\",\"\",\"\"\n",
      "\"7bb5432f-3d67-4d59-8a43-04e57e0dcc3f\",16,\"Network activity\",\"ip-src\",\"127.0.0.1\",\"\",1,1645191487,\"ip-src\",\"\",\"\",\"\",\"\"\n",
      "\"b663b3b3-92af-41bf-a18f-8582bd0983b1\",16,\"Network activity\",\"ip-src\",\"127.0.0.1\",\"\",1,1645191487,\"ip-src\",\"\",\"\",\"\",\"\"\n",
      "\"0ee4a946-d826-4884-aa28-e1b9da8cbbcb\",16,\"Network activity\",\"ip-src\",\"127.0.0.1\",\"\",1,1645191487,\"ip-src\",\"\",\"\",\"\",\"\"\n",
      "\"1f4b0f6b-6cf9-47bf-acd4-f15b33e7d588\",21,\"Network activity\",\"ip-src\",\"185.194.93.14\",\"Attribute #281 enriched by dns.\",0,1668077578,\"\",\"\",\"\",\"\",\"\"\n",
      "\"9f7f2d28-bcc8-466e-847f-3cf2a1ec4070\",21,\"Network activity\",\"ip-src\",\"31.22.121.122\",\"Attribute #291 enriched by dns.\",0,1663922175,\"\",\"\",\"\",\"\",\"\"\n",
      "\"8153e053-c7c3-4a34-ae1c-b5cd3c80ba06\",22,\"Network activity\",\"ip-src\",\"8.231.77.176\",\"\",0,1659602097,\"\",\"\",\"\",\"\",\"\"\n",
      "\"a57f70a2-70dd-4ea4-b879-fbcd03d465df\",24,\"Network activity\",\"ip-src\",\"8.231.77.176\",\"\",0,1662025545,\"\",\"another:tag\",\"\",\"\",\"\"\n",
      "\"af044e10-5549-4018-bc6b-162cde1a1016\",21,\"Network activity\",\"ip-src\",\"8.231.77.176\",\"\",0,1661517935,\"\",\"\",\"\",\"\",\"\"\n",
      "\"fbb12142-0f82-4430-b0bc-2b1f9e26af67\",23,\"Network activity\",\"ip-src\",\"8.231.77.176\",\"\",0,1661518277,\"\",\"\",\"\",\"\",\"\"\n",
      "\"a783c55f-ac52-44b4-8be1-74d52bc2c4c3\",17,\"Network activity\",\"ip-src\",\"8.231.77.176\",\"\",0,1661517997,\"\",\"\",\"\",\"\",\"\"\n",
      "\"90f6fd39-a426-43b3-9157-0c48bf0710fb\",22,\"Network activity\",\"ip-src\",\"31.22.121.122\",\"\",0,1661762437,\"\",\"\",\"\",\"\",\"\"\n",
      "\"bc0a1ba5-d337-42b3-81fe-9d4b75a17bec\",26,\"Network activity\",\"ip-src\",\"185.194.93.14\",\"\",0,1663137408,\"\",\"\",\"\",\"\",\"\"\n",
      "\"93931645-c86c-4dcf-aa4e-591edab44c4e\",26,\"Network activity\",\"ip-src\",\"8.8.8.8\",\"\",1,1663320641,\"\",\"\",\"\",\"\",\"\"\n",
      "\n",
      "\n"
     ]
    }
   ],
   "source": [
    "r1 = misp.search(\n",
    "    controller='attributes',\n",
    "    type_attribute=['ip-src', 'ip-dst'],\n",
    "    return_format='csv')\n",
    "print(r1)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Aggregated context** with `context-markdown`, `context` and `attack`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 510,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# Aggregated context data\n",
      "## Tags and Taxonomies\n",
      "#### admiralty-scale\n",
      "*The Admiralty Scale or Ranking (also called the NATO System) is used to rank the reliability of a source and the credibility of an information. Reference based on FM 2-22.3 (FM 34-52) HUMAN INTELLIGENCE COLLECTOR OPERATIONS and NATO documents.*\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #0eb100; color: white\">admiralty-scale:information-credibility=&quot;1&quot;</span></span>\n",
      "\n",
      "    - **information-credibility**: Information Credibility\n",
      "    - **1**: Confirmed by other sources\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #0fc000; color: white\">admiralty-scale:information-credibility=&quot;2&quot;</span></span>\n",
      "\n",
      "    - **information-credibility**: Information Credibility\n",
      "    - **2**: Probably true\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #054300; color: white\">admiralty-scale:source-reliability=&quot;a&quot;</span></span>\n",
      "\n",
      "    - **source-reliability**: Source Reliability\n",
      "    - **a**: Completely reliable\n",
      "#### economical-impact\n",
      "*Economical impact is a taxonomy to describe the financial impact as positive or negative gain to the tagged information (e.g. data exfiltration loss, a positive gain for an adversary).*\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #038e00; color: white\">economical-impact:loss=&quot;less-than-1B-euro&quot;</span></span>\n",
      "\n",
      "    - **loss**: Loss\n",
      "    - **less-than-1B-euro**: Less than 1 billion EUR\n",
      "#### osint\n",
      "*Open Source Intelligence - Classification (MISP taxonomies)*\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #0087e8; color: white\">osint:certainty=&quot;50&quot;</span></span>\n",
      "\n",
      "    - **certainty**: Certainty of the elements mentioned in this Open Source Intelligence\n",
      "    - **50**: Chances about even (probability equals 0.50 - 50%)\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #0071c3; color: white\">osint:lifetime=&quot;perpetual&quot;</span></span>\n",
      "\n",
      "    - **lifetime**: Lifetime of the information as Open Source Intelligence\n",
      "    - **perpetual**: Perpetual\n",
      "#### tlp\n",
      "*The Traffic Light Protocol - or short: TLP - was designed with the objective to create a favorable classification scheme for sharing sensitive information while keeping the control over its distribution at the same time.*\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #CC0033; color: white\">tlp:red</span></span>\n",
      "\n",
      "    - **red**: (TLP:RED) Information exclusively and directly given to (a group of) individual recipients. Sharing outside is not legitimate.\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #ffffff; color: black\">tlp:white</span></span>\n",
      "\n",
      "    - **white**: (TLP:WHITE) Information can be shared publicly in accordance with the law.\n",
      "#### workflow\n",
      "*Workflow support language is a common language to support intelligence analysts to perform their analysis on data and information.*\n",
      "- <span class=\"tag-container\"><span class=\"tag\" style=\"background-color: #f70085; color: white\">workflow:state=&quot;draft&quot;</span></span>\n",
      "\n",
      "    - **state**: State\n",
      "    - **draft**: Draft means the information tagged can be released as a preliminary version or outline\n",
      "## Galaxy Clusters\n",
      "#### <i class=\"fas fa-map\"></i> Misinformation Pattern\n",
      "*AM!TT Tactic*\n",
      "- *[Adapt existing narratives](https://localhost:8443/galaxy_clusters/view/2712)*\n",
      "Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger sca...\n",
      "#### <i class=\"fas fa-shield\"></i> Malpedia\n",
      "*Malware galaxy based on Malpedia archive.*\n",
      "- *[Kobalos](https://localhost:8443/galaxy_clusters/view/4530)*\n",
      "\n",
      "#### <i class=\"fas fa-map\"></i> Attack Pattern\n",
      "*ATT&amp;CK Tactic*\n",
      "- *[SSH - T1021.004](https://localhost:8443/galaxy_clusters/view/9691)*\n",
      "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.\n",
      "\n",
      "SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and...\n",
      "- *[Software - T1592.002](https://localhost:8443/galaxy_clusters/view/9721)*\n",
      "Adversaries may gather information about the victim&#039;s host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of...\n",
      "#### <i class=\"fas fa-link\"></i> Course of Action\n",
      "*ATT&amp;CK Mitigation*\n",
      "- *[Access Token Manipulation Mitigation - T1134](https://localhost:8443/galaxy_clusters/view/8213)*\n",
      "Access tokens are an integral part of the security system within Windows and cannot be turned off. However, an attacker must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require to ...\n",
      "#### <i class=\"fas fa-industry\"></i> Sector\n",
      "*Activity sectors*\n",
      "- *[Defense](https://localhost:8443/galaxy_clusters/view/2762)*\n",
      "\n",
      "- *[Infrastructure](https://localhost:8443/galaxy_clusters/view/2780)*\n",
      "\n",
      "#### <i class=\"fas fa-bullseye\"></i> Target Information\n",
      "*Description of targets of threat actors.*\n",
      "- *[Canada](https://localhost:8443/galaxy_clusters/view/1994)*\n",
      "\n",
      "- *[China](https://localhost:8443/galaxy_clusters/view/2000)*\n",
      "\n",
      "#### <i class=\"fas fa-user-secret\"></i> Threat Actor\n",
      "*Threat actors are characteristics of malicious actors (or adversaries) representing a cyber attack threat including presumed intent and historically observed behaviour.*\n",
      "- *[APT 29](https://localhost:8443/galaxy_clusters/view/7251)*\n",
      "A 2015 report by F-Secure describe APT29 as: &#039;The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. Th...\n"
     ]
    }
   ],
   "source": [
    "# Get the context of Events that were created by organisations from the financial sector\n",
    "\n",
    "body = {\n",
    "    'returnFormat': 'context-markdown',\n",
    "    'org.sector': ['financial'],\n",
    "}\n",
    "\n",
    "r2 = misp.direct_call('/events/restSearch', body)\n",
    "print(r2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 511,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Get the context of Events that had the threat actor APT-29 attached\n",
    "\n",
    "body = {\n",
    "    'returnFormat': 'context',\n",
    "    'tags': ['misp-galaxy:threat-actor=\\\"APT 29\\\"'],\n",
    "    'staticHtml': 1, # If you want a JS-free HTML\n",
    "}\n",
    "\n",
    "r2 = misp.direct_call('/events/restSearch', body)\n",
    "with open('/tmp/attackOutput.html', 'w') as f:\n",
    "    f.write(r2)\n",
    "    # subprocess.run(['google-chrome', '--incognito', '/tmp/attackOutput.html'])\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Be carefull with the amount of data you ask, use `pagination` if needed\n",
    "\n",
    "- `limit`: Specify the amount of data to be returned\n",
    "- `page`: Specify the start of the rolling window. Is **not** zero-indexed\n",
    "\n",
    "If the size of the returned data is larger than the memory enveloppe you might get a different behavior based on your MISP setting:\n",
    "- Nothing returned. Allowed memeory by PHP process exausted\n",
    "- Data returned but slow. MISP will concatenante the returned data in a temporary file on disk\n",
    "    - This behavior is only applicable for `/*/restSearch` endpoints"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "r1 = misp.search(controller='attributes', pythonify=True)\n",
    "print('Amount of Attributes', len(r1))\n",
    "\n",
    "r2 = misp.search(\n",
    "    controller='attributes',\n",
    "    page=1,\n",
    "    limit=5,\n",
    "    pythonify=True)\n",
    "print('Amount of paginated Attributes', len(r2))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Searching for Sightings"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 513,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[{'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1670924035',\n",
      "               'event_id': '40',\n",
      "               'id': '12',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '65bd7539-29eb-46eb-bf7b-4c02473062c7',\n",
      "               'value': '398324'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1670924430',\n",
      "               'event_id': '40',\n",
      "               'id': '13',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '10857410-0033-4457-8a1d-c8331ee55d72',\n",
      "               'value': '398324'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1670924454',\n",
      "               'event_id': '40',\n",
      "               'id': '14',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '1',\n",
      "               'uuid': '1639fe60-0458-40f3-961b-7dc14eee9a7b',\n",
      "               'value': '398324'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1670924455',\n",
      "               'event_id': '40',\n",
      "               'id': '15',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '1',\n",
      "               'uuid': 'ee54ec70-3597-4455-bce9-c889202d533e',\n",
      "               'value': '398324'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1670924456',\n",
      "               'event_id': '40',\n",
      "               'id': '16',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '1',\n",
      "               'uuid': '2c1cf4d1-a6ce-474b-8878-0251ee2b6bc5',\n",
      "               'value': '398324'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1448',\n",
      "               'date_sighting': '1671027299',\n",
      "               'event_id': '41',\n",
      "               'id': '17',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '39dff1d2-7082-48a9-8d30-ce29d412879b',\n",
      "               'value': 'testtest'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1448',\n",
      "               'date_sighting': '1671027301',\n",
      "               'event_id': '41',\n",
      "               'id': '18',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '84a8e7d0-715b-453f-8cdb-07db0c208185',\n",
      "               'value': 'testtest'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '77',\n",
      "               'date_sighting': '1671027307',\n",
      "               'event_id': '9',\n",
      "               'id': '19',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '264e4a25-e072-46e5-8460-b8df72e3115c',\n",
      "               'value': '5.4.2.1'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '77',\n",
      "               'date_sighting': '1671027308',\n",
      "               'event_id': '9',\n",
      "               'id': '20',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': 'b9f15aeb-54ea-44e5-90b8-22a418b973df',\n",
      "               'value': '5.4.2.1'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '243',\n",
      "               'date_sighting': '1671027309',\n",
      "               'event_id': '9',\n",
      "               'id': '21',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '4ef355f8-1cd3-476c-bccf-90a23b4eebfe',\n",
      "               'value': 'test'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1342',\n",
      "               'date_sighting': '1671029412',\n",
      "               'event_id': '29',\n",
      "               'id': '22',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': 'f0e76bec-2e04-4e88-a976-df831257c856',\n",
      "               'value': 'malware.exe|70f3bc193dfa56b78f3e6e4f800f701f'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1342',\n",
      "               'date_sighting': '1671029413',\n",
      "               'event_id': '29',\n",
      "               'id': '23',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': '803bb696-ae86-4a04-9793-5f54a45c99b7',\n",
      "               'value': 'malware.exe|70f3bc193dfa56b78f3e6e4f800f701f'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1342',\n",
      "               'date_sighting': '1671029414',\n",
      "               'event_id': '29',\n",
      "               'id': '24',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': 'fd8c4c0f-ebbb-4294-ade1-57493f1edc9a',\n",
      "               'value': 'malware.exe|70f3bc193dfa56b78f3e6e4f800f701f'}},\n",
      " {'Sighting': {'Organisation': {'id': '1',\n",
      "                                'name': 'ORGNAME',\n",
      "                                'uuid': 'c5de83b4-36ba-49d6-9530-2a315caeece6'},\n",
      "               'attribute_id': '1441',\n",
      "               'date_sighting': '1671030274',\n",
      "               'event_id': '40',\n",
      "               'id': '25',\n",
      "               'org_id': '1',\n",
      "               'source': '',\n",
      "               'type': '0',\n",
      "               'uuid': 'c84dd497-ad48-4b82-8203-6135a9a924fc',\n",
      "               'value': '398324'}}]\n"
     ]
    }
   ],
   "source": [
    "body = {\n",
    "    'last': '7d'\n",
    "}\n",
    "\n",
    "sightings = misp.direct_call('/sightings/restSearch', body)\n",
    "pprint(sightings)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Plotting data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Sightings over time"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 512,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 514,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>attribute_id</th>\n",
       "      <th>event_id</th>\n",
       "      <th>org_id</th>\n",
       "      <th>date_sighting</th>\n",
       "      <th>uuid</th>\n",
       "      <th>source</th>\n",
       "      <th>type</th>\n",
       "      <th>value</th>\n",
       "      <th>Organisation</th>\n",
       "      <th>one</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>12</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-13 09:33:55</td>\n",
       "      <td>65bd7539-29eb-46eb-bf7b-4c02473062c7</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>13</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-13 09:40:30</td>\n",
       "      <td>10857410-0033-4457-8a1d-c8331ee55d72</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>14</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-13 09:40:54</td>\n",
       "      <td>1639fe60-0458-40f3-961b-7dc14eee9a7b</td>\n",
       "      <td></td>\n",
       "      <td>1</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>15</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-13 09:40:55</td>\n",
       "      <td>ee54ec70-3597-4455-bce9-c889202d533e</td>\n",
       "      <td></td>\n",
       "      <td>1</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>16</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-13 09:40:56</td>\n",
       "      <td>2c1cf4d1-a6ce-474b-8878-0251ee2b6bc5</td>\n",
       "      <td></td>\n",
       "      <td>1</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>17</td>\n",
       "      <td>1448</td>\n",
       "      <td>41</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:14:59</td>\n",
       "      <td>39dff1d2-7082-48a9-8d30-ce29d412879b</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>testtest</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>18</td>\n",
       "      <td>1448</td>\n",
       "      <td>41</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:15:01</td>\n",
       "      <td>84a8e7d0-715b-453f-8cdb-07db0c208185</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>testtest</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>19</td>\n",
       "      <td>77</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:15:07</td>\n",
       "      <td>264e4a25-e072-46e5-8460-b8df72e3115c</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>5.4.2.1</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>20</td>\n",
       "      <td>77</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:15:08</td>\n",
       "      <td>b9f15aeb-54ea-44e5-90b8-22a418b973df</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>5.4.2.1</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>21</td>\n",
       "      <td>243</td>\n",
       "      <td>9</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:15:09</td>\n",
       "      <td>4ef355f8-1cd3-476c-bccf-90a23b4eebfe</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>test</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>22</td>\n",
       "      <td>1342</td>\n",
       "      <td>29</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:50:12</td>\n",
       "      <td>f0e76bec-2e04-4e88-a976-df831257c856</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>malware.exe|70f3bc193dfa56b78f3e6e4f800f701f</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>23</td>\n",
       "      <td>1342</td>\n",
       "      <td>29</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:50:13</td>\n",
       "      <td>803bb696-ae86-4a04-9793-5f54a45c99b7</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>malware.exe|70f3bc193dfa56b78f3e6e4f800f701f</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>24</td>\n",
       "      <td>1342</td>\n",
       "      <td>29</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 14:50:14</td>\n",
       "      <td>fd8c4c0f-ebbb-4294-ade1-57493f1edc9a</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>malware.exe|70f3bc193dfa56b78f3e6e4f800f701f</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>25</td>\n",
       "      <td>1441</td>\n",
       "      <td>40</td>\n",
       "      <td>1</td>\n",
       "      <td>2022-12-14 15:04:34</td>\n",
       "      <td>c84dd497-ad48-4b82-8203-6135a9a924fc</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>398324</td>\n",
       "      <td>{'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "    id attribute_id event_id org_id       date_sighting  \\\n",
       "0   12         1441       40      1 2022-12-13 09:33:55   \n",
       "1   13         1441       40      1 2022-12-13 09:40:30   \n",
       "2   14         1441       40      1 2022-12-13 09:40:54   \n",
       "3   15         1441       40      1 2022-12-13 09:40:55   \n",
       "4   16         1441       40      1 2022-12-13 09:40:56   \n",
       "5   17         1448       41      1 2022-12-14 14:14:59   \n",
       "6   18         1448       41      1 2022-12-14 14:15:01   \n",
       "7   19           77        9      1 2022-12-14 14:15:07   \n",
       "8   20           77        9      1 2022-12-14 14:15:08   \n",
       "9   21          243        9      1 2022-12-14 14:15:09   \n",
       "10  22         1342       29      1 2022-12-14 14:50:12   \n",
       "11  23         1342       29      1 2022-12-14 14:50:13   \n",
       "12  24         1342       29      1 2022-12-14 14:50:14   \n",
       "13  25         1441       40      1 2022-12-14 15:04:34   \n",
       "\n",
       "                                    uuid source type  \\\n",
       "0   65bd7539-29eb-46eb-bf7b-4c02473062c7           0   \n",
       "1   10857410-0033-4457-8a1d-c8331ee55d72           0   \n",
       "2   1639fe60-0458-40f3-961b-7dc14eee9a7b           1   \n",
       "3   ee54ec70-3597-4455-bce9-c889202d533e           1   \n",
       "4   2c1cf4d1-a6ce-474b-8878-0251ee2b6bc5           1   \n",
       "5   39dff1d2-7082-48a9-8d30-ce29d412879b           0   \n",
       "6   84a8e7d0-715b-453f-8cdb-07db0c208185           0   \n",
       "7   264e4a25-e072-46e5-8460-b8df72e3115c           0   \n",
       "8   b9f15aeb-54ea-44e5-90b8-22a418b973df           0   \n",
       "9   4ef355f8-1cd3-476c-bccf-90a23b4eebfe           0   \n",
       "10  f0e76bec-2e04-4e88-a976-df831257c856           0   \n",
       "11  803bb696-ae86-4a04-9793-5f54a45c99b7           0   \n",
       "12  fd8c4c0f-ebbb-4294-ade1-57493f1edc9a           0   \n",
       "13  c84dd497-ad48-4b82-8203-6135a9a924fc           0   \n",
       "\n",
       "                                           value  \\\n",
       "0                                         398324   \n",
       "1                                         398324   \n",
       "2                                         398324   \n",
       "3                                         398324   \n",
       "4                                         398324   \n",
       "5                                       testtest   \n",
       "6                                       testtest   \n",
       "7                                        5.4.2.1   \n",
       "8                                        5.4.2.1   \n",
       "9                                           test   \n",
       "10  malware.exe|70f3bc193dfa56b78f3e6e4f800f701f   \n",
       "11  malware.exe|70f3bc193dfa56b78f3e6e4f800f701f   \n",
       "12  malware.exe|70f3bc193dfa56b78f3e6e4f800f701f   \n",
       "13                                        398324   \n",
       "\n",
       "                                         Organisation  one  \n",
       "0   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "1   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "2   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "3   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "4   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "5   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "6   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "7   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "8   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "9   {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "10  {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "11  {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "12  {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  \n",
       "13  {'id': '1', 'uuid': 'c5de83b4-36ba-49d6-9530-2...    1  "
      ]
     },
     "execution_count": 514,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Converting our data to Panda DataFrame\n",
    "sighting_rearranged = [sighting['Sighting'] for sighting in sightings]\n",
    "df = pd.DataFrame.from_dict(sighting_rearranged)\n",
    "df[\"date_sighting\"] = pd.to_datetime(df[\"date_sighting\"], unit='s')\n",
    "df['one'] = 1\n",
    "df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "print('Min and Max:', df['date_sighting'].min(), df['date_sighting'].max())\n",
    "print('Time delta:', df['date_sighting'].max() - df['date_sighting'].min())\n",
    "print('Unique Event IDs:', df.event_id.unique())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 515,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "1441    6\n",
      "1342    3\n",
      "1448    2\n",
      "77      2\n",
      "243     1\n",
      "Name: attribute_id, dtype: int64\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<AxesSubplot: >"
      ]
     },
     "execution_count": 515,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAhYAAAGyCAYAAAC4Io22AAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjYuMiwgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy8o6BhiAAAACXBIWXMAAA9hAAAPYQGoP6dpAAAhQUlEQVR4nO3de1TUdf7H8dcAMmICKt6DVdrKBG/lLTLdLNNF87RtlrmWZrtdNS+UJZqarYa15SHbMu3mntZba2tlpXbZzDpo3kItjxomiGLaYjKKOQLz+f3hz1lJUQc/wzDD83HOnNMM32He9mGYJ9/5zozDGGMEAABgQVigBwAAAKGDsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1EVV9gx6PRwUFBYqOjpbD4ajqmwcAAJVgjNHhw4fVvHlzhYVVvF+iysOioKBACQkJVX2zAADAgvz8fMXHx1f49SoPi+joaEknBouJianqmwcAAJXgcrmUkJDgfRyvSJWHxcmnP2JiYggLAACCzLkOY+DgTQAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArPE5LPbu3as777xTcXFxioqKUtu2bbV+/Xp/zAYAAIKMT58V8vPPP6tbt27q2bOnli1bpkaNGun7779X/fr1/TUfAAAIIj6FxTPPPKOEhAS9+eab3ssSExOtDwUAAIKTT0+FvP/+++rUqZNuu+02NW7cWFdeeaVeffXVs17H7XbL5XKVOwEAgNDk0x6LH374QbNmzVJaWprGjx+vdevWaeTIkYqMjNTQoUPPeJ2MjAxNmTLFyrDnq+W4D6v09vwld3q/QI8AAIBPHMYYc74bR0ZGqlOnTsrKyvJeNnLkSK1bt06rV68+43Xcbrfcbrf3vMvlUkJCgoqKihQTE3MBo1eMsAAAwC6Xy6XY2NhzPn779FRIs2bNlJSUVO6y1q1ba/fu3RVex+l0KiYmptwJAACEJp/Colu3btq+fXu5y3bs2KEWLVpYHQoAAAQnn8JizJgxWrNmjZ5++mnl5ORo/vz5mjNnjoYPH+6v+QAAQBDxKSw6d+6sJUuWaMGCBWrTpo3++te/KjMzU4MHD/bXfAAAIIj49KoQSbrpppt00003+WMWAAAQ5PisEAAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGt8Cosnn3xSDoej3OmKK67w12wAACDIRPh6heTkZH366af/+wYRPn8LAAAQonyugoiICDVt2tQfswAAgCDn8zEW33//vZo3b65LLrlEgwcP1u7du8+6vdvtlsvlKncCAAChyaew6Nq1q+bOnavly5dr1qxZ2rVrl7p3767Dhw9XeJ2MjAzFxsZ6TwkJCRc8NAAAqJ4cxhhT2SsfOnRILVq00IwZM/TnP//5jNu43W653W7veZfLpYSEBBUVFSkmJqayN31WLcd96JfvW9Vyp/cL9AgAAEg68fgdGxt7zsfvCzrysl69err88suVk5NT4TZOp1NOp/NCbgYAAASJC3ofiyNHjmjnzp1q1qyZrXkAAEAQ8yksHn30UX3xxRfKzc1VVlaWbrnlFoWHh2vQoEH+mg8AAAQRn54K2bNnjwYNGqTCwkI1atRI1157rdasWaNGjRr5az4AABBEfAqLhQsX+msOAAAQAvisEAAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhzQWExffp0ORwOjR492tI4AAAgmFU6LNatW6fZs2erXbt2NucBAABBrFJhceTIEQ0ePFivvvqq6tevb3smAAAQpCoVFsOHD1e/fv3Uq1cv2/MAAIAgFuHrFRYuXKiNGzdq3bp157W92+2W2+32nne5XL7eJAAACBI+7bHIz8/XqFGjNG/ePNWuXfu8rpORkaHY2FjvKSEhoVKDAgCA6s9hjDHnu/G7776rW265ReHh4d7LysrK5HA4FBYWJrfbXe5r0pn3WCQkJKioqEgxMTEW/gmnaznuQ79836qWO71foEcAAEDSicfv2NjYcz5++/RUyA033KAtW7aUu2zYsGG64oor9Pjjj58WFZLkdDrldDp9uRkAABCkfAqL6OhotWnTptxlF110keLi4k67HAAA1Dy88yYAALDG51eF/NrKlSstjAEAAEIBeywAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACs8SksZs2apXbt2ikmJkYxMTFKSUnRsmXL/DUbAAAIMj6FRXx8vKZPn64NGzZo/fr1uv7663XzzTfru+++89d8AAAgiET4snH//v3LnZ82bZpmzZqlNWvWKDk52epgAAAg+PgUFqcqKyvTv/71LxUXFyslJaXC7dxut9xut/e8y+Wq7E0CAIBqzuew2LJli1JSUnTs2DHVrVtXS5YsUVJSUoXbZ2RkaMqUKRc0JIJby3EfBnqEC5Y7vV+gRwCAoODzq0JatWql7Oxsff3113rwwQc1dOhQbd26tcLt09PTVVRU5D3l5+df0MAAAKD68nmPRWRkpC699FJJUseOHbVu3Tq98MILmj179hm3dzqdcjqdFzYlAAAIChf8PhYej6fcMRQAAKDm8mmPRXp6ulJTU/Wb3/xGhw8f1vz587Vy5UqtWLHCX/MBAIAg4lNYHDhwQEOGDNG+ffsUGxurdu3aacWKFbrxxhv9NR8AAAgiPoXF66+/7q85AABACOCzQgAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKwhLAAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKwhLAAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKwhLAAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKwhLAAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKwhLAAAgDWEBQAAsIawAAAA1hAWAADAGsICAABYQ1gAAABrCAsAAGANYQEAAKzxKSwyMjLUuXNnRUdHq3HjxvrDH/6g7du3+2s2AAAQZHwKiy+++ELDhw/XmjVr9Mknn6ikpES9e/dWcXGxv+YDAABBJMKXjZcvX17u/Ny5c9W4cWNt2LBBPXr0sDoYAAAIPj6Fxa8VFRVJkho0aFDhNm63W26323ve5XJdyE0CAIBqrNJh4fF4NHr0aHXr1k1t2rSpcLuMjAxNmTKlsjcDwKKW4z4M9AgXLHd6v0CPYEUorIUUOusBeyr9qpDhw4fr22+/1cKFC8+6XXp6uoqKiryn/Pz8yt4kAACo5iq1x2LEiBH64IMPtGrVKsXHx591W6fTKafTWanhAABAcPEpLIwxevjhh7VkyRKtXLlSiYmJ/poLAAAEIZ/CYvjw4Zo/f77ee+89RUdH68cff5QkxcbGKioqyi8DAgCA4OHTMRazZs1SUVGRrrvuOjVr1sx7WrRokb/mAwAAQcTnp0IAAAAqwmeFAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBqfw2LVqlXq37+/mjdvLofDoXfffdcPYwEAgGDkc1gUFxerffv2eumll/wxDwAACGIRvl4hNTVVqamp/pgFAAAEOY6xAAAA1vi8x8JXbrdbbrfbe97lcvn7JgEAQID4PSwyMjI0ZcoUf98MAACV0nLch4EewYrc6f0CPYKkKngqJD09XUVFRd5Tfn6+v28SAAAEiN/3WDidTjmdTn/fDAAAqAZ8DosjR44oJyfHe37Xrl3Kzs5WgwYN9Jvf/MbqcAAAILj4HBbr169Xz549vefT0tIkSUOHDtXcuXOtDQYAAIKPz2Fx3XXXyRjjj1kAAECQ430sAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArCEsAACANYQFAACwhrAAAADWEBYAAMAawgIAAFhDWAAAAGsICwAAYA1hAQAArKlUWLz00ktq2bKlateura5du2rt2rW25wIAAEHI57BYtGiR0tLSNHnyZG3cuFHt27dXnz59dODAAX/MBwAAgojPYTFjxgzde++9GjZsmJKSkvTKK6+oTp06euONN/wxHwAACCIRvmx8/PhxbdiwQenp6d7LwsLC1KtXL61evfqM13G73XK73d7zRUVFkiSXy1WZec+Lx33Ub9+7Kvnz/1FVCoX1YC2qD9aiegmF9WAtfPv+xpizb2h8sHfvXiPJZGVllbt87NixpkuXLme8zuTJk40kTpw4ceLEiVMInPLz88/aCj7tsaiM9PR0paWlec97PB4dPHhQcXFxcjgc/r55v3C5XEpISFB+fr5iYmICPU6NxlpUL6xH9cFaVB+hshbGGB0+fFjNmzc/63Y+hUXDhg0VHh6u/fv3l7t8//79atq06Rmv43Q65XQ6y11Wr149X2622oqJiQnqH5JQwlpUL6xH9cFaVB+hsBaxsbHn3MangzcjIyPVsWNHffbZZ97LPB6PPvvsM6WkpPg+IQAACCk+PxWSlpamoUOHqlOnTurSpYsyMzNVXFysYcOG+WM+AAAQRHwOi4EDB+qnn37SpEmT9OOPP6pDhw5avny5mjRp4o/5qiWn06nJkyef9hQPqh5rUb2wHtUHa1F91LS1cJhzvm4EAADg/PBZIQAAwBrCAgAAWENYAAAAawgLAABgDWEBAACsISwAIESd+gGQQFUhLFAj8Krq6sXj8QR6hJC3fft2TZgwQSUlJYEeBecQar+f/P4hZDWRx+NRWBjNFkjHjh3T8ePHvZ9V43A4ZIwJ2g++C3YFBQXatm2bCgsLddtttyksLIz7iR9t3rxZXbt2ldvtVs+ePdWvX79Aj4T/l5ubqyVLlujIkSNq1aqVbr/99pD7vcQbZFmSk5OjefPmaezYsapTpw6/NANo69ateuKJJ7Rjxw61aNFC/fv31wMPPBDosWqsLVu2aMCAAYqMjFReXp7atWunr776KtBjhaxNmzYpJSVF99xzjwoLCxUeHq45c+YoKioq5B7Ags3mzZuVmpqq1q1bq7i4WLm5ucrMzNTAgQMDPZpVPPJZkJOTo27duunFF1/UxIkTdfToUe9fZKhaW7duVY8ePdSsWTM99NBDio2N1bx587Rx48ZAj1Yj7dq1S3369NHgwYP1/vvva9myZcrLy9P69esDPVpI2rhxo7p37660tDT9/e9/19VXX62lS5eqoKDAu9cOgbFjxw717dtXQ4YM0YoVK/T222+rbdu2OnLkSKBHs449FheoqKhId999tyIiIpSYmKhVq1YpJSVF06ZNY89FFSssLNStt96qDh06KDMzU5J08OBBXXXVVRo+fLjGjh0b2AFroNmzZ+vf//63li5dqsjISJWWlurGG2/UQw89pEOHDql///5q2rRpoMcMCS6XS82bN9d9992nGTNmSJJKSkp0zTXXKCkpSXPnzmWPRYCUlJTogQceUGlpqV5//XVFRJw4CuH2229XVFSU6tevrxYtWmjMmDEBntQOHvEuUN26dZWUlKQBAwZo6tSp6tevn1avXq3x48efcc8FHec/eXl5atKkiW699VZJUmlpqRo0aKC+ffuqsLBQkliLKpafn69t27YpMjJSkpSZmamsrCxlZmZq+vTpuuqqq7x7L1iPytuzZ492796tjRs3eqPCGKOwsDD17t1bGzZs0H//+1/v5ahatWrV0iOPPKJ7773XGxUZGRlavHixysrK9Msvv+ixxx4LnadsDS5YSUmJ97+PHj1qpkyZYrp27WpGjRpljh49aowx5tixY4Ear8bYv3+/WbBggfe8x+MxxhjzwAMPmGHDhgVqrBpt8+bNpmnTpua3v/2tue2220ytWrXMihUrTFFRkTHGmJ49e5oePXoEeMrgtmXLFpOQkGDS0tKMMcaUlpYaY/73879//34THR1tnnrqqYDNWFOd+thwquzsbJOSkmI+/PBD72Vvv/22qVu3rvn222+rajy/YY9FJRQUFGjfvn3e8ycLtLS0VFFRUXr88cfVt29fff311xo/frwOHTqk4cOHe/+Shj0FBQUqKCiQJDVu3Fh33HGHJJ32CpBTX8//zDPPaOrUqVU7aA3x6/tGq1at9Omnn2rUqFG6/PLLdffdd6t3797ej4/u06ePSkpKdPz48UCNHNQ2bdqkrl27KiIiQvPnz9eBAwcUHh4uSXI4HCorK1Pjxo11//33a/ny5dq9e3eAJ645tm/frieeeEI5OTmnfa19+/ZavHix+vbt673M4/EoMTFRzZo1q8ox/YKw8FFeXp4SEhJ05513eh/QToqIiJDH45HT6dTjjz+u1NRUrV27Vl26dNGiRYt4jt+yk2tx1113ae/eveW+dmpUNGzYUNHR0ZKk8ePHa9KkSerfv3+VzloTnOm+ERkZqeTkZD388MM6duyY9uzZI0nesNi5c6eaN2/O7vlKOPnqj9GjR2vt2rWKi4vTq6++KmOM9//nycjo3bu3tmzZwkHMVcAYo19++UV33XWXnn32WT3//PPKz8/3fr20tFSSTguIDRs2qEWLFqpVq1aVzusXAd1fEoQ2bdpkWrRoYRo1amRSUlJMQUGB92sndz2e3P1VVFRk2rZta+rXr282b94ckHlD2fmshTHGjB071owYMcI89dRTpnbt2mb9+vWBGDfk/Xo99u7dW+7rS5cuNcnJyWbSpElm5cqVJi0tzcTFxYXErt+qtmnTJuN0Os348eONMcaUlZWZAQMGmM6dO3u3OfU+YIwxqamppnv37qasrOy0r8G+8ePHm2HDhpmoqCgzaNAgs2vXrjNut2/fPjNhwgRTr169kHmcICx84PF4zM6dO03fvn3Ntm3bTFJSkunWrZspLCw0xhizbds277Zut9uMHj3a1KlTJ2R+WKoTX9ZizJgxxuFwmIsuuoio8JNzrccPP/xgXC6XGTdunImPjzeXXnqp6dKli8nOzg7w5MFp7dq1ZuLEicaYE1FhzImf+djYWPPyyy+f8TpLliwxOTk5VTZjTXVyPUaNGmVeeukl89133xmn02mGDBliiouLzd/+9jeTm5trjDFm9erV5i9/+Ytp2bKl+eabbwI4tV283LQSevXqpRkzZqh27drq16+f4uPj1aRJE0nS66+/rosuukiSNHLkSA0dOlQdO3YM5Lgh7Wxr8dprr6lu3bqaOXOmZs6cqffee0/JyckBnji0VbQeHo9Hb7/9to4ePaqff/5ZR48eVaNGjVSvXr1AjxwSjDFyuVy6++67FRkZqfnz5yssLIyXlwbQ8uXLtXjxYr322mtat26dunfvrmbNmqmkpERffvmlEhMTlZubq+zsbLVv316JiYmBHtmeAIdNUPF4PKa0tNRcf/315pVXXjHGnHi6IzY21oSFhZmPP/44wBPWHGVlZee9Fvn5+SY/Pz9Qo9YI57pvrFixIsAT1gzvvPOOcTgc5quvvgr0KDXSqU8xffbZZ6ZVq1beVwampqaasLAwk5qaavbt23fG64QKDt48i4MHD+qnn34qd1l4eLh69uypY8eOSZJGjBghp9Op+Ph4Pf30096D02CXMUZlZWXe82FhYedci5MHTMXHxys+Pj4gc4cqX+8bGRkZ3DeqwE033aQbb7xRs2bN0i+//BLocWqE4uJiHT58WC6Xq9weotatW+uyyy5TVFSU7rnnHm3ZskVvvPGGvvzyS91///3e+0Mo7lUiLCrwww8/qHPnznrxxRe9R7if/AFo3LixsrKyNGTIEH388cf6/PPPlZWVpc2bN+vee+8t9wCIC7djxw6NGTNGN998s5566invm11JZ1+L++67z3sENuzhvlF9RUZGqmfPnlq6dKmKiooCPU7I27p1q/74xz/qd7/7nVq3bq158+Z5v9a4cWMdPnxYzZs310cffaQlS5Zo6NCh+uijj/T111+H9Dsy8+mmFfjkk0+0a9cuffDBB6pdu7buuece71sPJyUlacKECWrQoIE++ugjJSUlSZK++eYbHT9+3PsSL1y4LVu2qFevXurRo4fi4+M1bdo0GWM0efJkSVJycrImTpyoevXqnXEtTr7HCOzhvlE9mf9/75b7779fixcv9u45gn+c/FyiIUOGqFOnTtqwYYOGDRum5ORkdejQQcYYde/eXQ6HQ88//7yuuuoqlZWVqXv37srNzVXt2rUD/U/wGw7erMDmzZs1Y8YMXXbZZXr55Zf14IMPasSIEd6DzebMmaNrrrlGbdq0CeygIWzXrl26/vrrNWjQID399NOSpClTpujAgQPKzMxUrVq1VFZWptmzZ+vaa69Vu3btAjxxzcB9o3ozxujo0aPeg8hh38GDBzVo0CBdccUVeuGFF7yX9+zZU23bttXMmTMlST/++KOMMae9Z4X51Rv4hRr+nKuAMUZZWVl68803VVZWpjlz5ig6Olr/+c9/1KVLF02YMCHQI4a0srIyvfPOO0pNTdW4ceO8l+/Zs0ffffedunXrpg4dOmjgwIF66KGHAjhpzcN9o3pzOBxEhZ+VlJTo0KFDGjBggCR5P2wyMTFRBw8e9F5W0QfshXJUSIRFhU6+/CcvL0+TJk1SVFSUJkyYoIiICB7IqkB4eLjuuOMO7dmzRzExMZKkqVOn6s0339S4cePUpEkTvfXWW9q5c6eSk5P5hMwqxH0DNV2TJk30z3/+U5dddpmkE38IhYWF6eKLL1ZeXp4keY+hOHLkiOrWrRuwWQMhdI8e8UFFB5QdP35cq1atknTifd/Dw8MVFRWlzZs3n/Z23rDj1LWIj4/X1VdfLenER6IXFhbqgw8+0NSpU/Xwww/rH//4hz7//HNlZ2cHaNrQx30DOLOTUeHxeLxvw22M0YEDB7zbZGRkaM6cOTXuIPIaHxY7duxQZmZmuQ9OKikpkSR17dpVYWFhGjlypJYtW6bs7GyNHDlSTz75pBYuXMgR7padaS1OiouL07Rp0/T73/9exhh5PB6Vlpbqyiuv1MUXXxyAaUMf9w3g3MLCwsp91s3JPRWTJk3ShAkTdMMNN9S4g8hr1r/2V3JycpSSkqKff/5ZhYWFSktLU8OGDb312apVKw0ZMkRNmzbV+++/r8TERKWnpys8PFz9+/fnCHeLKloL6X8HOkVFRUk68fykw+HQwoULVatWLZ4G8QPuG8D5O/k7KiIiQgkJCXruuef07LPPav369Wrfvn2gx6tyNfZVIcXFxRo5cqQ8Ho86d+6sESNG6NFHH9Vjjz3mfUDbsWOH3nrrLd16663q0KGD9wAd2HU+a3GqrVu3asGCBZo5c6a+/PJLXg1iGfcNoHKmTZumiRMnKiYmRp9++qk6deoU6JECosbusQgLC1PHjh0VFxengQMHqmHDhrrjjjskyfsL9PLLL1d6errq1KkjKfSP5A2U81mLk3bv3q0nnnhC27Zt06pVq4gKP+C+AVROnz59NHHiRGVlZXnfw6UmqrF7LKQTf5md+rKsRYsWadCgQXrkkUf02GOPqVGjRvJ4PMrLywutD4iphs62FuPGjVNcXJzKyspUWFio48ePSxJv0+1H3DeAyvn1facmqrF7LCR5F//kS4UGDhwoY4z+9Kc/yeFwaPTo0XruueeUl5ent956y/vXGew737XYtWuXFixYENLvWlcdcN8AKqemR4VUw/dYnMoYI2OMwsLCtGjRIt1111265JJLtHPnTq1bt04dOnQI9Ig1xtnWYu3atbryyisDPWKNwn0DgC8Ii1Oc/F/hcDh0ww03KDs7WytXrlTbtm0DPFnNw1pUL6wHgPNVo58K+TWHw6GysjKNHTvW+8ZL/OIMDNaiemE9AJwvXh92BsnJydq4cSOvOKgGWIvqhfUAcC48FXIGof7Jc8GEtaheWA8A50JYAAAAa3gqBAAAWENYAAAAawgLAABgDWEBAACsISwAAIA1hAUAALCGsAAAANYQFgAAwBrCAgAAWENYAAAAa/4PFusAbA7eHkYAAAAASUVORK5CYII=",
      "text/plain": [
       "<Figure size 640x480 with 1 Axes>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Grouping by Attribute value\n",
    "value_count = df['attribute_id'].value_counts()\n",
    "print(value_count)\n",
    "value_count.plot(kind='bar', rot=45)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 516,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "2    9\n",
      "1    5\n",
      "Name: date_sighting, dtype: int64\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<AxesSubplot: >"
      ]
     },
     "execution_count": 516,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAhYAAAGdCAYAAABO2DpVAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjYuMiwgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy8o6BhiAAAACXBIWXMAAA9hAAAPYQGoP6dpAAAQG0lEQVR4nO3dX2jVdR/A8c9UOlnMPWrNFFdKBOafytKihCiKIizyJgoMzCCiZmZC5C4shtQSQgYl9geqXaTWjRU9ZIgwRUoqrciLNKmnRmEaxWYLTuL2XDw02KOrfvNzth19veB3cb7+fvw+QafefH/neGp6e3t7AwAgwajhHgAAOH0ICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgzZihvmFPT0/8+OOPUVtbGzU1NUN9ewBgEHp7e+Po0aMxZcqUGDVq4H2JIQ+LH3/8MRoaGob6tgBAgo6Ojpg6deqAfz7kYVFbWxsR/xts3LhxQ317AGAQurq6oqGhoe//4wMZ8rD48/HHuHHjhAUAVJm/+xiDD28CAGmEBQCQRlgAAGmEBQCQRlgAAGmEBQCQRlgAAGmEBQCQRlgAAGmEBQCQRlgAAGmEBQCQRlgAAGmEBQCQZsh/Nv1MNm3Vv4d7BIbQf55dONwjAAw5OxYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkKRQWx48fj9WrV8f06dNj7NixcfHFF8eaNWuit7e3UvMBAFVkTJGT165dGxs2bIi2traYNWtWfPrpp7F06dKoq6uL5cuXV2pGAKBKFAqLDz/8MO68885YuHBhRERMmzYtNm3aFB9//HFFhgMAqkuhRyHXXXddbN++PQ4cOBAREV988UXs2rUrbrvttgGvKZfL0dXV1e8AAE5PhXYsVq1aFV1dXTFjxowYPXp0HD9+PJ5++ulYvHjxgNe0tLREc3PzKQ8KAIx8hXYs3nrrrXjjjTdi48aNsXfv3mhra4vnnnsu2traBrymqakpOjs7+46Ojo5THhoAGJkK7Vg8/vjjsWrVqrjnnnsiImLOnDnx3XffRUtLSyxZsuSk15RKpSiVSqc+KQAw4hXasfj9999j1Kj+l4wePTp6enpShwIAqlOhHYs77rgjnn766bjwwgtj1qxZ8dlnn8W6devi/vvvr9R8AEAVKRQWzz//fKxevToefvjhOHz4cEyZMiUefPDBePLJJys1HwBQRQqFRW1tbbS2tkZra2uFxgEAqpnfCgEA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0ggLACCNsAAA0hQOix9++CHuvffemDhxYowdOzbmzJkTn376aSVmAwCqzJgiJ//666+xYMGCuPHGG+P999+P888/P77++usYP358peYDAKpIobBYu3ZtNDQ0xGuvvda3Nn369PShAIDqVOhRyLvvvhvz5s2Lu+66K+rr62Pu3LnxyiuvVGo2AKDKFAqLb775JjZs2BCXXHJJfPDBB/HQQw/F8uXLo62tbcBryuVydHV19TsAgNNToUchPT09MW/evHjmmWciImLu3Lmxb9++ePHFF2PJkiUnvaalpSWam5tPfVIAYMQrtGMxefLkmDlzZr+1Sy+9NL7//vsBr2lqaorOzs6+o6OjY3CTAgAjXqEdiwULFsT+/fv7rR04cCAuuuiiAa8plUpRKpUGNx0AUFUK7Vg89thjsXv37njmmWfi4MGDsXHjxnj55ZejsbGxUvMBAFWkUFjMnz8/tmzZEps2bYrZs2fHmjVrorW1NRYvXlyp+QCAKlLoUUhExO233x633357JWYBAKqc3woBANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANIICwAgjbAAANKMGe4BAE4H01b9e7hHYAj959mFwz3CiGXHAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDTCAgBIIywAgDSnFBbPPvts1NTUxIoVK5LGAQCq2aDD4pNPPomXXnopLrvsssx5AIAqNqiw+O2332Lx4sXxyiuvxPjx47NnAgCq1KDCorGxMRYuXBg333zz355bLpejq6ur3wEAnJ7GFL1g8+bNsXfv3vjkk0/+0fktLS3R3NxceDAAoPoU2rHo6OiIRx99NN544404++yz/9E1TU1N0dnZ2Xd0dHQMalAAYOQrtGOxZ8+eOHz4cFx55ZV9a8ePH4+dO3fGCy+8EOVyOUaPHt3vmlKpFKVSKWdaAGBEKxQWN910U3z55Zf91pYuXRozZsyIJ5544oSoAADOLIXCora2NmbPnt1v7dxzz42JEyeesA4AnHn8zZsAQJrC3wr5f+3t7QljAACnAzsWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAEAaYQEApBEWAECaQmHR0tIS8+fPj9ra2qivr49FixbF/v37KzUbAFBlCoXFjh07orGxMXbv3h3btm2LY8eOxS233BLd3d2Vmg8AqCJjipy8devWfq9ff/31qK+vjz179sT111+fOhgAUH0KhcX/6+zsjIiICRMmDHhOuVyOcrnc97qrq+tUbgkAjGCD/vBmT09PrFixIhYsWBCzZ88e8LyWlpaoq6vrOxoaGgZ7SwBghBt0WDQ2Nsa+ffti8+bNf3leU1NTdHZ29h0dHR2DvSUAMMIN6lHIsmXL4r333oudO3fG1KlT//LcUqkUpVJpUMMBANWlUFj09vbGI488Elu2bIn29vaYPn16peYCAKpQobBobGyMjRs3xjvvvBO1tbVx6NChiIioq6uLsWPHVmRAAKB6FPqMxYYNG6KzszNuuOGGmDx5ct/x5ptvVmo+AKCKFH4UAgAwEL8VAgCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkERYAQBphAQCkGVRYrF+/PqZNmxZnn312XHPNNfHxxx9nzwUAVKHCYfHmm2/GypUr46mnnoq9e/fG5ZdfHrfeemscPny4EvMBAFWkcFisW7cuHnjggVi6dGnMnDkzXnzxxTjnnHPi1VdfrcR8AEAVGVPk5D/++CP27NkTTU1NfWujRo2Km2++OT766KOTXlMul6NcLve97uzsjIiIrq6uwcxb1XrKvw/3CAyhM/Hf8TOZ9/eZ5Ux8f//5z9zb2/uX5xUKi59//jmOHz8ekyZN6rc+adKk+Oqrr056TUtLSzQ3N5+w3tDQUOTWUHXqWod7AqBSzuT399GjR6Ourm7APy8UFoPR1NQUK1eu7Hvd09MTv/zyS0ycODFqamoqfXuGWVdXVzQ0NERHR0eMGzduuMcBEnl/n1l6e3vj6NGjMWXKlL88r1BYnHfeeTF69Oj46aef+q3/9NNPccEFF5z0mlKpFKVSqd/av/71ryK35TQwbtw4/+GB05T395njr3Yq/lTow5tnnXVWXHXVVbF9+/a+tZ6enti+fXtce+21xScEAE4rhR+FrFy5MpYsWRLz5s2Lq6++OlpbW6O7uzuWLl1aifkAgCpSOCzuvvvuOHLkSDz55JNx6NChuOKKK2Lr1q0nfKATIv73KOypp5464XEYUP28vzmZmt6/+94IAMA/5LdCAIA0wgIASCMsAIA0wgIASCMsSNfS0hLz58+P2traqK+vj0WLFsX+/fuHeywgyc6dO+OOO+6IKVOmRE1NTbz99tvDPRIjiLAg3Y4dO6KxsTF2794d27Zti2PHjsUtt9wS3d3dwz0akKC7uzsuv/zyWL9+/XCPwgjk66ZU3JEjR6K+vj527NgR119//XCPAySqqamJLVu2xKJFi4Z7FEYIOxZUXGdnZ0RETJgwYZgnAaDShAUV1dPTEytWrIgFCxbE7Nmzh3scACqs4j+bzpmtsbEx9u3bF7t27RruUQAYAsKCilm2bFm89957sXPnzpg6depwjwPAEBAWpOvt7Y1HHnkktmzZEu3t7TF9+vThHgmAISIsSNfY2BgbN26Md955J2pra+PQoUMREVFXVxdjx44d5umAU/Xbb7/FwYMH+15/++238fnnn8eECRPiwgsvHMbJGAl83ZR0NTU1J11/7bXX4r777hvaYYB07e3tceONN56wvmTJknj99deHfiBGFGEBAKTxdVMAII2wAADSCAsAII2wAADSCAsAII2wAADSCAsAII2wAADSCAsAII2wAADSCAsAII2wAADS/BfCDdsjZARtJAAAAABJRU5ErkJggg==",
      "text/plain": [
       "<Figure size 640x480 with 1 Axes>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# Grouping by weekday (0-indexed)\n",
    "amount_per_weekday = df['date_sighting'].dt.weekday.value_counts()\n",
    "print(amount_per_weekday)\n",
    "amount_per_weekday.plot(kind='bar', rot=0)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 517,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "date_sighting\n",
      "9     5\n",
      "14    8\n",
      "15    1\n",
      "Name: one, dtype: int64\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "<AxesSubplot: xlabel='date_sighting'>"
      ]
     },
     "execution_count": 517,
     "metadata": {},
     "output_type": "execute_result"
    },
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAhYAAAGxCAYAAAA+tv8YAAAAOXRFWHRTb2Z0d2FyZQBNYXRwbG90bGliIHZlcnNpb24zLjYuMiwgaHR0cHM6Ly9tYXRwbG90bGliLm9yZy8o6BhiAAAACXBIWXMAAA9hAAAPYQGoP6dpAAAeUklEQVR4nO3dfZBV9XnA8ee6KxeU3VUQBHQRRAsCASMYRnyJVhS2hNFOmraWmAXUUYsaJBjZcTQySBaaxMFm7NJkUkB8QROrJhpDhQnYaIiAwUhSUSzKqiS0FHcBk9Xu3v6RceOW17v8lt0Ln8/MmfGce849z05O9Ms5d7mZXC6XCwCABI5p7wEAgCOHsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSKD/cJm5qa4r333ouSkpLIZDKH+/QAQCvkcrnYuXNn9OnTJ445Zt/3JQ57WLz33ntRXl5+uE8LACRQW1sbp5566j5fP+xhUVJSEhF/HKy0tPRwnx4AaIX6+vooLy9v/u/4vhz2sPj48UdpaamwAIACc6CPMfjwJgCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSySssGhsb484774z+/ftHly5dYsCAATF79uzI5XJtNR8AUEDy+q6QefPmRU1NTSxevDiGDBkSa9eujcmTJ0dZWVnccsstbTUjAFAg8gqLF198Ma644ooYP358RET069cvHnnkkXjppZfaZDgAoLDk9Shk9OjRsWLFinj99dcjIuKVV16Jn/3sZ1FRUdEmwwEAhSWvOxYzZ86M+vr6GDRoUBQVFUVjY2PMmTMnJk6cuM9jGhoaoqGhoXm9vr6+9dMCAB1aXmHx2GOPxUMPPRQPP/xwDBkyJNavXx/Tpk2LPn36RGVl5V6Pqa6ujlmzZiUZFo5m/WY+094jHDHemju+vUeAI1Yml8evdJSXl8fMmTNj6tSpzdvuueeeePDBB+O1117b6zF7u2NRXl4edXV1UVpaegijw9FFWKQjLCB/9fX1UVZWdsD/fud1x+KDDz6IY45p+bGMoqKiaGpq2ucx2Ww2stlsPqcBAApUXmExYcKEmDNnTvTt2zeGDBkSv/zlL+Pee++NKVOmtNV8AEABySssvv3tb8edd94Zf//3fx/btm2LPn36xPXXXx933XVXW80HABSQvMKipKQk5s+fH/Pnz2+jcQCAQua7QgCAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGTyCot+/fpFJpPZY5k6dWpbzQcAFJDifHZes2ZNNDY2Nq9v2LAhLrvssvjCF76QfDAAoPDkFRY9evRosT537twYMGBAfPazn006FABQmFr9GYsPP/wwHnzwwZgyZUpkMpmUMwEABSqvOxaf9OSTT8b7778fkyZN2u9+DQ0N0dDQ0LxeX1/f2lMCAB1cq+9YfO9734uKioro06fPfverrq6OsrKy5qW8vLy1pwQAOrhWhcXbb78dy5cvj2uvvfaA+1ZVVUVdXV3zUltb25pTAgAFoFWPQhYuXBg9e/aM8ePHH3DfbDYb2Wy2NacBAApM3ncsmpqaYuHChVFZWRnFxa3+iAYAcATKOyyWL18eW7ZsiSlTprTFPABAAcv7lsPll18euVyuLWYBAAqc7woBAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSyTss3n333fjiF78Y3bt3jy5dusSnPvWpWLt2bVvMBgAUmOJ8dt6xY0ecf/75cckll8Szzz4bPXr0iDfeeCNOPPHEtpoPACggeYXFvHnzory8PBYuXNi8rX///smHAgAKU16PQn74wx/GyJEj4wtf+EL07NkzPv3pT8d3v/vdtpoNACgweYXFf/7nf0ZNTU2ceeaZsWzZsrjxxhvjlltuicWLF+/zmIaGhqivr2+xAABHprwehTQ1NcXIkSPj61//ekREfPrTn44NGzbEggULorKycq/HVFdXx6xZsw59UgCgw8vrjkXv3r1j8ODBLbadddZZsWXLln0eU1VVFXV1dc1LbW1t6yYFADq8vO5YnH/++bFx48YW215//fU47bTT9nlMNpuNbDbbuukAgIKS1x2LW2+9NVavXh1f//rXY9OmTfHwww/Hd77znZg6dWpbzQcAFJC8wuLcc8+NJ554Ih555JEYOnRozJ49O+bPnx8TJ05sq/kAgAKS16OQiIjPfe5z8bnPfa4tZgEACpzvCgEAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJLJKyzuvvvuyGQyLZZBgwa11WwAQIEpzveAIUOGxPLly//0BsV5vwUAcITKuwqKi4ujV69ebTELAFDg8v6MxRtvvBF9+vSJ008/PSZOnBhbtmxpi7kAgAKU1x2LUaNGxaJFi2LgwIGxdevWmDVrVlx44YWxYcOGKCkp2esxDQ0N0dDQ0LxeX19/aBMDAB1WXmFRUVHR/M/Dhg2LUaNGxWmnnRaPPfZYXHPNNXs9prq6OmbNmnVoU7aDfjOfae8RjhhvzR3f3iMAcJgc0q+bnnDCCfFnf/ZnsWnTpn3uU1VVFXV1dc1LbW3toZwSAOjADiksdu3aFW+++Wb07t17n/tks9koLS1tsQAAR6a8wmLGjBmxatWqeOutt+LFF1+Mv/zLv4yioqK46qqr2mo+AKCA5PUZi3feeSeuuuqq2L59e/To0SMuuOCCWL16dfTo0aOt5gMACkheYbF06dK2mgMAOAL4rhAAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACCZQwqLuXPnRiaTiWnTpiUaBwAoZK0OizVr1sQ///M/x7Bhw1LOAwAUsFaFxa5du2LixInx3e9+N0488cTUMwEABapVYTF16tQYP358jBkzJvU8AEABK873gKVLl8bLL78ca9asOaj9GxoaoqGhoXm9vr4+31MCAAUirzsWtbW18eUvfzkeeuih6Ny580EdU11dHWVlZc1LeXl5qwYFADq+vMJi3bp1sW3btjjnnHOiuLg4iouLY9WqVfGP//iPUVxcHI2NjXscU1VVFXV1dc1LbW1tsuEBgI4lr0chl156abz66qsttk2ePDkGDRoUt99+exQVFe1xTDabjWw2e2hTAgAFIa+wKCkpiaFDh7bYdvzxx0f37t332A4AHH38zZsAQDJ5/1bI/7dy5coEYwAARwJ3LACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGTyCouampoYNmxYlJaWRmlpaZx33nnx7LPPttVsAECBySssTj311Jg7d26sW7cu1q5dG3/+538eV1xxRfz6179uq/kAgAJSnM/OEyZMaLE+Z86cqKmpidWrV8eQIUOSDgYAFJ68wuKTGhsb4/vf/37s3r07zjvvvJQzAQAFKu+wePXVV+O8886LP/zhD9G1a9d44oknYvDgwfvcv6GhIRoaGprX6+vrWzcpANDh5f1bIQMHDoz169fHL37xi7jxxhujsrIyfvOb3+xz/+rq6igrK2teysvLD2lgAKDjyjssOnXqFGeccUaMGDEiqqurY/jw4XHfffftc/+qqqqoq6trXmpraw9pYACg42r1Zyw+1tTU1OJRx/+XzWYjm80e6mkAgAKQV1hUVVVFRUVF9O3bN3bu3BkPP/xwrFy5MpYtW9ZW8wEABSSvsNi2bVt86Utfiq1bt0ZZWVkMGzYsli1bFpdddllbzQcAFJC8wuJ73/teW80BABwBfFcIAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQTF5hUV1dHeeee26UlJREz54948orr4yNGze21WwAQIHJKyxWrVoVU6dOjdWrV8dzzz0XH330UVx++eWxe/futpoPACggxfns/JOf/KTF+qJFi6Jnz56xbt26uOiii5IOBgAUnkP6jEVdXV1ERHTr1i3JMABAYcvrjsUnNTU1xbRp0+L888+PoUOH7nO/hoaGaGhoaF6vr69v7SkBgA6u1Xcspk6dGhs2bIilS5fud7/q6uooKytrXsrLy1t7SgCgg2tVWNx0003x9NNPx09/+tM49dRT97tvVVVV1NXVNS+1tbWtGhQA6PjyehSSy+Xi5ptvjieeeCJWrlwZ/fv3P+Ax2Ww2stlsqwcEAApHXmExderUePjhh+Opp56KkpKS+O1vfxsREWVlZdGlS5c2GRAAKBx5PQqpqamJurq6uPjii6N3797Ny6OPPtpW8wEABSTvRyEAAPviu0IAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBk8g6L559/PiZMmBB9+vSJTCYTTz75ZBuMBQAUorzDYvfu3TF8+PC4//7722IeAKCAFed7QEVFRVRUVLTFLABAgfMZCwAgmbzvWOSroaEhGhoamtfr6+vb+pQAQDtp87Corq6OWbNmtfVpAGgH/WY+094jHBHemju+vUdIps0fhVRVVUVdXV3zUltb29anBADaSZvfschms5HNZtv6NABAB5B3WOzatSs2bdrUvL558+ZYv359dOvWLfr27Zt0OACgsOQdFmvXro1LLrmkeX369OkREVFZWRmLFi1KNhgAUHjyDouLL744crlcW8wCABQ4f48FAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQjLAAAJIRFgBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERYAQDLCAgBIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAywgIASEZYAADJCAsAIBlhAQAkIywAgGSEBQCQTKvC4v77749+/fpF586dY9SoUfHSSy+lngsAKEB5h8Wjjz4a06dPj6997Wvx8ssvx/Dhw2Ps2LGxbdu2tpgPACggeYfFvffeG9ddd11Mnjw5Bg8eHAsWLIjjjjsu/uVf/qUt5gMACkheYfHhhx/GunXrYsyYMX96g2OOiTFjxsTPf/7z5MMBAIWlOJ+d//u//zsaGxvj5JNPbrH95JNPjtdee22vxzQ0NERDQ0Pzel1dXURE1NfX5zvrYdXU8EF7j3DE6Oj/WxcK12Q6rsl0XJdpFMI1+fGMuVxuv/vlFRatUV1dHbNmzdpje3l5eVufmg6ibH57TwAtuSbpaArpmty5c2eUlZXt8/W8wuKkk06KoqKi+N3vftdi++9+97vo1avXXo+pqqqK6dOnN683NTXF//zP/0T37t0jk8nkc3o+ob6+PsrLy6O2tjZKS0vbexyICNclHY9rMp1cLhc7d+6MPn367He/vMKiU6dOMWLEiFixYkVceeWVEfHHUFixYkXcdNNNez0mm81GNpttse2EE07I57TsR2lpqf+z0OG4LuloXJNp7O9OxcfyfhQyffr0qKysjJEjR8ZnPvOZmD9/fuzevTsmT57cqiEBgCNH3mHxN3/zN/Ff//Vfcdddd8Vvf/vbOPvss+MnP/nJHh/oBACOPq368OZNN920z0cfHB7ZbDa+9rWv7fGYCdqT65KOxjV5+GVyB/q9EQCAg+RLyACAZIQFAJCMsAAAkhEWBWjnzp0xbdq0OO2006JLly4xevToWLNmTXuPxVHi+eefjwkTJkSfPn0ik8nEk08+uc99b7jhhshkMjF//vzDNh9HpwNdl5MmTYpMJtNiGTduXPsMe4QTFgXo2muvjeeeey6WLFkSr776alx++eUxZsyYePfdd9t7NI4Cu3fvjuHDh8f999+/3/2eeOKJWL169QH/lj5I4WCuy3HjxsXWrVubl0ceeeQwTnj0aPPvCiGt3//+9/H444/HU089FRdddFFERNx9993xox/9KGpqauKee+5p5wk50lVUVERFRcV+93n33Xfj5ptvjmXLlsX48eMP02QczQ7musxms/v8+gnScceiwPzv//5vNDY2RufOnVts79KlS/zsZz9rp6ngT5qamuLqq6+O2267LYYMGdLe40CzlStXRs+ePWPgwIFx4403xvbt29t7pCOSsCgwJSUlcd5558Xs2bPjvffei8bGxnjwwQfj5z//eWzdurW9x4OYN29eFBcXxy233NLeo0CzcePGxQMPPBArVqyIefPmxapVq6KioiIaGxvbe7QjjkchBWjJkiUxZcqUOOWUU6KoqCjOOeecuOqqq2LdunXtPRpHuXXr1sV9990XL7/8sm8vpkP527/92+Z//tSnPhXDhg2LAQMGxMqVK+PSSy9tx8mOPO5YFKABAwbEqlWrYteuXVFbWxsvvfRSfPTRR3H66ae392gc5f793/89tm3bFn379o3i4uIoLi6Ot99+O77yla9Ev3792ns8aHb66afHSSedFJs2bWrvUY447lgUsOOPPz6OP/742LFjRyxbtiz+4R/+ob1H4ih39dVXx5gxY1psGzt2bFx99dW+AZkO5Z133ont27dH796923uUI46wKEDLli2LXC4XAwcOjE2bNsVtt90WgwYN8i9uDotdu3a1+FPe5s2bY/369dGtW7fo27dvdO/evcX+xx57bPTq1SsGDhx4uEflKLK/67Jbt24xa9as+PznPx+9evWKN998M7761a/GGWecEWPHjm3HqY9MwqIA1dXVRVVVVbzzzjvRrVu3+PznPx9z5syJY489tr1H4yiwdu3auOSSS5rXp0+fHhERlZWVsWjRonaaiqPd/q7Lmpqa+NWvfhWLFy+O999/P/r06ROXX355zJ4927eetgHfbgoAJOPDmwBAMsICAEhGWAAAyQgLACAZYQEAJCMsAIBkhAUAkIywAACSERZQQC6++OKYNm1ae4+xV2+99VZkMplYv379QR+zaNGiOOGEEw7LuYDDQ1jAEWrlypWRyWTi/fffPyznKy8vj61bt8bQoUOTvu+kSZPiyiuvPCznAg6d7woBkigqKopevXodcecC8uOOBXRQu3fvji996UvRtWvX6N27d3zrW99q8fqSJUti5MiRUVJSEr169Yq/+7u/i23btkXEHx8VfPyFTCeeeGJkMpmYNGlSREQ0NTVFdXV19O/fP7p06RLDhw+PH/zgBwc1044dO2LixInRo0eP6NKlS5x55pmxcOHC5nP+/8cTP/zhD+PMM8+Mzp07xyWXXBKLFy/e612UZcuWxVlnnRVdu3aNcePGxdatWyMi4u67747FixfHU089FZlMJjKZTKxcuXKPc318d2bFihUxcuTIOO6442L06NGxcePGFue55557omfPnlFSUhLXXnttzJw5M84+++yD+tmBgyMsoIO67bbbYtWqVfHUU0/Fv/3bv8XKlSvj5Zdfbn79o48+itmzZ8crr7wSTz75ZLz11lvN8VBeXh6PP/54RERs3Lgxtm7dGvfdd19ERFRXV8cDDzwQCxYsiF//+tdx6623xhe/+MVYtWrVAWe688474ze/+U08++yz8R//8R9RU1MTJ5100l733bx5c/zVX/1VXHnllfHKK6/E9ddfH3fcccce+33wwQfxzW9+M5YsWRLPP/98bNmyJWbMmBERETNmzIi//uu/bo6NrVu3xujRo/c53x133BHf+ta3Yu3atVFcXBxTpkxpfu2hhx6KOXPmxLx582LdunXRt2/fqKmpOeDPDOQpB3Q4O3fuzHXq1Cn32GOPNW/bvn17rkuXLrkvf/nLez1mzZo1uYjI7dy5M5fL5XI//elPcxGR27FjR/M+f/jDH3LHHXdc7sUXX2xx7DXXXJO76qqrDjjXhAkTcpMnT97ra5s3b85FRO6Xv/xlLpfL5W6//fbc0KFDW+xzxx13tJhp4cKFuYjIbdq0qXmf+++/P3fyySc3r1dWVuauuOKK/Z7r4591+fLlzfs888wzuYjI/f73v8/lcrncqFGjclOnTm3xPueff35u+PDhB/y5gYPnjgV0QG+++WZ8+OGHMWrUqOZt3bp1i4EDBzavr1u3LiZMmBB9+/aNkpKS+OxnPxsREVu2bNnn+27atCk++OCDuOyyy6Jr167NywMPPBBvvvnmAee68cYbY+nSpXH22WfHV7/61XjxxRf3ue/GjRvj3HPPbbHtM5/5zB77HXfccTFgwIDm9d69ezc/0snXsGHDWrxPRDS/18aNG/c4/97mAQ6ND29CAdq9e3eMHTs2xo4dGw899FD06NEjtmzZEmPHjo0PP/xwn8ft2rUrIiKeeeaZOOWUU1q8ls1mD3jeioqKePvtt+PHP/5xPPfcc3HppZfG1KlT45vf/Garf5Zjjz22xXomk4lcLnfI75XJZCLij58pAQ4fdyygAxowYEAce+yx8Ytf/KJ5244dO+L111+PiIjXXnsttm/fHnPnzo0LL7wwBg0atMef8jt16hQREY2Njc3bBg8eHNlsNrZs2RJnnHFGi6W8vPygZuvRo0dUVlbGgw8+GPPnz4/vfOc7e91v4MCBsXbt2hbb1qxZc1Dn+P8/xyd/htYaOHDgHudvzTzA/rljAR1Q165d45prronbbrstunfvHj179ow77rgjjjnmj38W6Nu3b3Tq1Cm+/e1vxw033BAbNmyI2bNnt3iP0047LTKZTDz99NPxF3/xF9GlS5coKSmJGTNmxK233hpNTU1xwQUXRF1dXbzwwgtRWloalZWV+53rrrvuihEjRsSQIUOioaEhnn766TjrrLP2uu/1118f9957b9x+++1xzTXXxPr162PRokUR8ae7CQejX79+sWzZsti4cWN07949ysrKDvrYT7r55pvjuuuui5EjR8bo0aPj0UcfjV/96ldx+umnt+r9gL1zxwI6qG984xtx4YUXxoQJE2LMmDFxwQUXxIgRIyLij3cNFi1aFN///vdj8ODBMXfu3D0eR5xyyikxa9asmDlzZpx88slx0003RUTE7Nmz484774zq6uo466yzYty4cfHMM89E//79DzhTp06doqqqKoYNGxYXXXRRFBUVxdKlS/e6b//+/eMHP/hB/Ou//msMGzYsampqmn8r5GAeu3zsuuuui4EDB8bIkSOjR48e8cILLxz0sZ80ceLEqKqqihkzZsQ555wTmzdvjkmTJkXnzp1b9X7A3mVyrX2YCZCnOXPmxIIFC6K2tra9R4mIiMsuuyx69eoVS5Ysae9R4IjhUQjQZv7pn/4pzj333OjevXu88MIL8Y1vfKP5zsnh9sEHH8SCBQti7NixUVRUFI888kgsX748nnvuuXaZB45UHoUAzW644YYWv4b6yeWGG27I+/3eeOONuOKKK2Lw4MExe/bs+MpXvhJ33313+sEPQiaTiR//+Mdx0UUXxYgRI+JHP/pRPP744zFmzJh2mQeOVB6FAM22bdsW9fX1e32ttLQ0evbseZgnAgqNsAAAkvEoBABIRlgAAMkICwAgGWEBACQjLACAZIQFAJCMsAAAkhEWAEAy/weQUvStHTG7NQAAAABJRU5ErkJggg==",
      "text/plain": [
       "<Figure size 640x480 with 1 Axes>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "amount_per_weekday_for_each_attribute = df.groupby([df['date_sighting'].dt.hour])['one'].sum()\n",
    "print(amount_per_weekday_for_each_attribute)\n",
    "amount_per_weekday_for_each_attribute.plot(kind='bar', rot=0)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3.8.10 ('venv': venv)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  },
  "orig_nbformat": 4,
  "vscode": {
   "interpreter": {
    "hash": "99e19f785595e5572f3a0434505ffd496bc893a60c3b4501be593ee9ddcf6bde"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
